Atlassian October bulletin lists 176 flaw entries in Jira and Confluence
Critical scores are third-party library ratings; Atlassian says its product risk is lower and not immediately critical.
58
Product
Apache Tomcat
- Mentions · 7d0
- Mentions · 30d10
- All mentions29
- First seenAug 17, 2026
- Last mentioned8d ago
Timeline
29 articles · newest firstOctober 21 fixes cover PHP2Shell, LiteLLM theft, and VPN attacks
Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; LiteLLM 1.107.0 stole secrets, so pin 1.106.2 and rotate them.
86
Tomcat HTTP/2 async flaw can mix users' requests (CVE-2026-101356)
Apache rates the issue important; the excerpt lists three affected version ranges and no fix.
64
Tomcat JNDIRealm auth fails open for non-GSSAPI SASL (CVE-2026-101296)
Apache rates the flaw important across Tomcat 7 through 11 ranges when JNDIRealm uses non-GSSAPI SASL.
64
Apache Tomcat incomplete cleanup can drop TLS 1.3 connections
Apache rates CVE-2026-93446 low; affected 9, 10.1, and 11 lines can fail TLS 1.3 intermittently.
28
Tomcat HTTP/2 trailer headers can leak into the next request
Apache rates the incomplete cleanup low; fixed releases are not named in the posted notice.
36
Tomcat APR sockets still exposed by TOCTOU after earlier fix
An unauthorised local user can reach the APR/Native Unix domain socket on Tomcat 9.0.47 through 9.0.122.
34
Tomcat Jasper JSTL omits page abort after redirect (CVE-2026-74049)
Mark Thomas rated the execution-after-redirect flaw low across listed Tomcat 7 through 11 builds; the excerpt names no fix.
32
Tomcat keeps starting if OpenSSL FIPS activation fails (CVE-2026-74048)
With OpenSSLLifecycleListener in FIPS mode, a failed activation leaves Tomcat on non-FIPS JSSE; severity is low.
30
Hackers Use AI Agents and GodPotato Exploit to Gain Windows SYSTEM Privileges
Attackers used AI agents and GodPotato to turn an exposed Tomcat endpoint into Windows SYSTEM access.
68
Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
68
Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
68
CVE-2026-87022: Apache Tomcat: WebSocket message smuggling with per-message-deflate
Apache Tomcat can smuggle WebSocket messages when per-message-deflate length handling is inconsistent.
34
CVE-2026-86350: Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
A Tomcat regression of the CVE-2026-41293 fix can mix HTTP/2 request headers.
58
CVE-2026-86248: Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
Apache Tomcat CVE-2026-86248 can soft-fail some OCSP checks during client-certificate authentication.
54
CVE-2026-79677: Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
Apache Tomcat patches a moderate WebSocket denial of service caused by a lost write timeout.
44
CVE-2026-78437: Apache Tomcat: HTTP/2 DoS via malformed request
A low-severity Apache Tomcat HTTP/2 flaw can fail another user's request after malformed input.
30
CVE-2026-78383: Apache Tomcat: AJP DoS via missing request body
Unauthenticated AJP requests can pin Apache Tomcat threads and cause denial of service.
52
CVE-2026-77791: Apache Tomcat: DoS via busy wait during WebSocket close
Apache Tomcat WebSocket close handling can busy-wait, enabling denial of service across multiple supported versions.
58
CVE-2026-77762: Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
Apache Tomcat race lets a stale HPACK emitter inject trailers into another recycled request.
34
CVE-2026-77756: Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
Low-severity Tomcat flaw honors Transfer-Encoding on HTTP/1.0, enabling request smuggling.
38
CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints
Apache Tomcat CVE-2026-76183 lets attackers bypass security constraints on any WebSocket endpoint.
68
CVE-2026-75973: Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured
Low-severity Tomcat CVE-2026-75973 can mix authentication across apps using Jakarta Authentication.
32
CVE-2026-73581: Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Moderate Tomcat CVE-2026-73581 makes OpenSSL TLS stacks ignore CRLs for keystore certificates.
48
Hackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation
Google GTIG reports threat actors using agentic AI to automate reconnaissance, exploit selection, and credential harvesting, compromising thousands of secrets.
72
CVE-2026-34486: Apache Software Foundation Apache Tomcat
CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.
72
CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass
Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.
65
CVE-2026-34486: Apache Tomcat Auth Bypass Vulnerability
SentinelOne details CVE-2026-34486, an Apache Tomcat EncryptInterceptor bypass exposing unencrypted cluster communications, with patches and workarounds available.
45
CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)
Attackers actively exploit Spring Framework RCE CVE-2022-22965 (SpringShell, CVSS 9.8) to deploy webshells; patches 5.3.18/5.2.20 shipped March 31, 2022.
82
Related CVEs
by mentions- CVE-2026-3448699%7.5EncryptInterceptor Bypass Exposes Cluster Traffic in Apache Tomcat
- Client-Certificate Authentication Bypass via OCSP Soft-Fail in Apache Tomcat
- CVE-2026-412932%9.8Improper Input Validation vulnerability in Apache Tomcat
- HTTP/2 Request Smuggling Regression in Apache Tomcat 9, 10.1 and 11
- HTTP/2 Trailer Injection Race Condition in Apache Tomcat
- Denial of Service in Apache Tomcat WebSocket Close Message Handling
- WebSocket Async Write Timeout DoS in Apache Tomcat
- Incomplete Cleanup in Apache Tomcat Causes Cross-User Request Failure via HTTP/2
- Cross-Application Authentication Bypass in Apache Tomcat
- Certificate Revocation Check Bypass in Apache Tomcat TLS
Appears with
- Apachevendor · 24
- Apache Software Foundationorganization · 12
- Apache Software Foundationvendor · 5
- Langflowproduct · 2
- Unit 42organization · 2
- HeroDevsorganization · 1
- Nettyproduct · 1
- DeepSeek Hermes Agentai model · 1
- Marimoproduct · 1
- Microsoft SQL Serverproduct · 1
- Cloudflareorganization · 1
- Node.jsproduct · 1
- knaithethreat actor · 1
- Mozillaorganization · 1
- Jakarta Authenticationproduct · 1
- Microsoftvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.